#!/usr/bin/env bash

# The app's release job (#7), in OxygenFlow's Android image with no network:

# a signed release APK of the version in gradle.properties, checked with

# apksigner, in dist/ beside its SHA256SUMS, for a release on oxygenhub.io.

#

# The key comes from the job's secrets, mounted as files and never in the

# environment: android-keystore (the PKCS12 keystore, base64) and

# android-keystore-password; and firebase-config (google-services.json, for

# alerts). Locally, give the same files:

#   KEYSTORE_B64=path PASSWORD_FILE=path [FIREBASE_CONFIG=path] scripts/release.sh

set -euo pipefail

cd "$(dirname "$0")/.."

b64=${KEYSTORE_B64:-/run/secrets/android-keystore}

password=${PASSWORD_FILE:-/run/secrets/android-keystore-password}

# Firebase's client settings for alerts (#16): google-services.json, the

# repository's firebase-config secret; without it the release takes no alerts.

firebase=${FIREBASE_CONFIG:-/run/secrets/firebase-config}

for f in "$b64" "$password"; do

    [ -s "$f" ] || { echo "release: no $f: the job needs the android-keystore secrets" >&2; exit 1; }

done

version=$(sed -n 's/^oxygenhub\.version=//p' gradle.properties)

[ -n "$version" ] || { echo "release: no oxygenhub.version in gradle.properties" >&2; exit 1; }

# As ci.sh: the image's JDKs for Gradle's daemon, never a download.

jdks=$( (ls -d /opt/gradle-home/jdks/*/ 2>/dev/null || true) | sed 's:/$::' | paste -sd, -)

if [ -n "$jdks" ] && [ -n "${GRADLE_USER_HOME:-}" ]; then

    mkdir -p "$GRADLE_USER_HOME"

    {

        echo "org.gradle.java.installations.paths=$jdks"

        echo "org.gradle.java.installations.auto-download=false"

    } >> "$GRADLE_USER_HOME/gradle.properties"

fi

# The keystore, decoded where only this job can read it, and gone after.

keys=$(mktemp -d)

trap 'rm -rf "$keys"' EXIT

chmod 700 "$keys"

base64 -d "$b64" > "$keys/release.p12"

export OXYGENHUB_KEYSTORE="$keys/release.p12" OXYGENHUB_KEYSTORE_PASSWORD_FILE="$password"

if [ -s "$firebase" ]; then

    cp "$firebase" app/google-services.json

    trap 'rm -rf "$keys" app/google-services.json' EXIT

else

    echo "release: no $firebase: this release takes no alerts" >&2

fi

gradle=$(command -v gradle || echo ./gradlew)

"$gradle" --offline --no-daemon :app:assembleRelease

apk=app/build/outputs/apk/release/app-release.apk

[ -f "$apk" ] || { echo "release: no $apk (was it signed? an unsigned build is app-release-unsigned.apk)" >&2; exit 1; }

sdk=${ANDROID_HOME:-${ANDROID_SDK_ROOT:-}}

apksigner=$(ls -d "$sdk"/build-tools/*/apksigner 2>/dev/null | sort -V | tail -1)

"$apksigner" verify --print-certs "$apk" | grep -E '^Signer #1 certificate (DN|SHA-256)'

# Kept as an artifact by a fixed name; SHA256SUMS gives the name it takes

# in a release, with the version (as OxygenHub's and OxygenFlow's dist do).

rm -rf dist

mkdir -p dist

cp "$apk" dist/oxygenhub-android-universal.apk

echo "$(sha256sum < dist/oxygenhub-android-universal.apk | cut -d' ' -f1)  oxygenhub-android-$version-universal.apk" > dist/SHA256SUMS

echo "release: oxygenhub-android-$version-universal.apk"